SapphireStealer Targets Russians With Fake Legal Docs

CRIL observed a campaign targeting Russian individuals that distributes the open‑source SapphireStealer via a fake Russian government website and likely spam links; the .NET executable masquerades as a PDF, drops lure PDF documents, and stealthily collects browser credentials, Telegram data, FileZilla and SSH files, and desktop files, compressing them into a ZIP and exfiltrating to a C2 (example IP 193.39.185.4). The report includes deobfuscated code behavior, MITRE ATT&CK mappings, IOCs (hashes, domain, URL, IP), and recommended mitigations such as email filtering, AV, MFA and backups.